electron-builder: Cannot find valid code signing certificate despite valid identities being printed in console during build

The “3rd Party Mac Developer Application” =/= “Developer ID Application”

I just found out that you should be able to generate one of the correct type of profiles from XCode but you need to be the team agent in your Apple Developer program (if you are enterprise)

Try XCode > Preferences > Accounts > … > Manage Certificates > + > Developer ID Application

Is security find-identity -vp codesigning able to find your certs?

Here’s what worked for me, hopefuly it’ll be useful to someone else that runs into this issue:

1. How do I check I have a valid identity certificate?

Run security find-identity -vp codesigning. You should see a 1 valid identities found. If it shows 0, it means you need to generate a new one.

2. What specific certificates do I need?

• If your app will be distributed inside the App store, you’ll need: Mac App Distribution and Mac Installer Distribution.
• If your app will be distributed outside the Mac App Store: Developer ID Application and Developer ID Installer

3. Where do I get those certificates?

You can generate them here. Choose the ones according to the previous point.

IMPORTANT: If you have XCode 11 or later, you will need to generate new developer and installer certificates even if the ones on your the apple website are not expired! Make sure you select Profile Type > G2 Sub-CA (Xcode 11.4.1 or later) on the “Create a New Certificate” screen!

Download them and double-click them to add to your keychain

4. Is that it?

No. You also need to ensure you have a Certification Authority. To check

certtool y | grep Developer\ I

This should print a list

   Common Name     : Developer ID Certification Authority
   Common Name     : Developer ID Installer: <Your name> (XXX)
   Common Name     : Developer ID Application: <Your name> (XXX)

You should have them all 3. If you’re missing the authority one, go to this page. In my case, I needed the Developer ID - G2 and the Worldwide Developer Relations - G2.

Good luck.

I had the same issue, turns out that Mac updates have installed XCode 11 and the signing script is now looking for different certificates.

You need to log in here and download certificates for: Apple Development Apple Distribution https://developer.apple.com/account/resources/certificates/list

The old Developer ID XXX ones don’t seem to work anymore.

After installing the above certs … running security find-identity -vp codesigning shows the certs are found

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

This Apple stuff is a total crap…

It does not work neither with ‘Apple Distribution’ nor with ‘Developer ID Application’

What is ‘3rd Party Mac Developer Application’? is there any guide how to generate this one?

Any updates on this? 😦

I met the same issue today. It turns out that I didn’t install the intermediate cert. After I installed the intermediate cert, the issue disappeared.

Be aware that another reason for this to fail is if you try to do it via remote SSH or via a CI server. The fact there is no GUI means the keychain remains locked, meaning there is no access to the key.

The clue to this will that it reports a errSecInternalComponent error. And the command to run (in the SSH) before you trigger your build is: security unlock-keychain -p {account-password} login.keychain

See also https://github.com/electron-userland/electron-builder/issues/4455#

@zhaoterryy no it’s not listing in my case. I have a Developer ID Application: xxx.... visible in keychain but not in command line. Any tips more than welcome, thanks.

I’m seeing same issue, I think. I can see the certificates in keychains, with private key, but “security find-identity” doesn’t show them. code sign won’t let me use them for signing. Stuck. If I take the “-p codesigning” off the end of the security command the missing certs show up. I just can’t use them.